Where $param is the original param, and $cleaned is the cleaned one. This is really broken with PARAM_BOOL. For example if you pass 'yes', then clean_param will produce 1, and of course 'yes' !== 1

The worst case (and the case that I personally ran in to) is when boolean false is passed. When false is cast to a string, we get the empty string, but clean_param returns 0 so we end up comparing '' to 0, and it flakes out. Small snippet to demonstrate: